Signs of OPM Hack Turn Up at Another Federal Agency

The National Archives and Records Administration recently detected unauthorized activity on three desktops indicative of the same hack that extracted sensitive details on millions of current and former federal employees, government officials said June 22. The revelation suggests the breadth of one of the most damaging cyberassaults known is wider than officials have disclosed. The National Archives' own intrusion-prevention technology successfully spotted the so-called indicators of compromise during a scan this spring, said a source involved in the investigation, who was not authorized to speak publicly about the incident.

The discovery was made soon after the Department of Homeland Security's US Computer Emergency Readiness Team published signs of the wider attack -- which targeted the Office of Personnel Management -- to look for at agencies, according to NARA. It is unclear when NARA computers were breached. Suspected Chinese-sponsored cyberspies reportedly had been inside OPM's networks for a year before the agency discovered what happened in April. Subsequently, the government uncovered a related attack against OPM that mined biographical information on individuals who have filed background investigation forms to access classified secrets. The National Archives has found no evidence intruders obtained "administrative access," or took control, of systems, but files were found in places they did not belong, the investigator said.